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Sir: 

STATUS OF CLAIMS 

Applicant appeals claims 2-18, 20, 22-25 and 27-30 of the pending claims. All of the 

pending claims have been rejected in the Final Office Action, mailed September 10, 2002, 

under 35 U.S.C. § 103(a) as being unpatentable over an article entitled, "Towards On-Line 

Analytical Mining in Large Databases," by Jiawei Han (hereinafter Han) in view of U.S. 

Patent No. 6,236,978 issued to Tuzhilin, (hereinafter Tuzhilin) further in view of U.S. Patent 

No. 5,790,645 issued to Fawcett et al. (hereinafter Fawcett). 

STATUS OF AMENDMENTS 

An amendment was filed subsequent to final rejection on December 10, 2002, 
amending claims 2-18, 20, 22-25 and 27-30. The after-final amendments have been entered 
by the Examiner for the purposes of this appeal (see Advisory Action of January 1 5, 2003). 
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SUMMARY OF INVENTION 

A first embodiment of an OLAP-based method for detecting telecommunication fraud 
according to the present invention system is illustrated in Figures 1-4. First, a plurality of call 
records from the data warehouse are retrieved (e.g., steps 300 and 308). Next, a calling 
profile cube based on the call records is generated (e.g., steps 304, 312 or 316). The calling 
profile cube includes information on multiple customers. A volume-based calling pattern 
cube is then generated for each individual customer based on the multi-customer calling 
profile cube (step 318). The volume-based calling pattern cube for each customer may then 
be compared with predetermined fraudulent volume-based calling patterns by behavior 
pattern comparison module (BPCM 168 of FIG. 2), for example. When the volume-based 
calling pattern cube is in a first predetermined relationship with predetermined fraudulent 
volume=based-calling-pattern ? _performing.a.first.action. 

A second embodiment of an OLAP-based method for detecting telecommunication 
fraud according to the present invention system is illustrated in Figures 1-4 and employs 
probability-based fraudulent patterns. In this embodiment, after the volume-based calling 
pattern cube (e.g., a calling pattern cube for each individual customer) has been generated, a 
probability-based calling pattern cube is generated based on the volume-based calling pattern 
cube by a volume-based to probability-based conversion module (VPCM 164 of FIG. 2), for 
example. The probability-based calling pattern may then be compared with known 
probability-based fraudulent patterns by behavior pattern comparison module (BPCM 168 of 
FIG. 2). If the similarities generated by the comparison reaches or exceeds a predetermined 
threshold, then the particular caller with the calling pattern being analyzed is considered 
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suspicious. One advantage of the second embodiment over the first embodiment described 
above is that two patterns that cover different time periods can be compared and analyzed. 



ISSUE 

Whether claims 2, 4-14, 16-18, 20, 22-25, 27-30 are patentable under 35 U.S.C. 
103(a) over Jiawei Han ("Towards On-Line Analytical Mining in Large Databases", 
hereinafter the Han reference) in view of U.S. Patent No. 6,236,978 to Tuzhilin, (hereinafter 
Tuzhilin) further in view of U.S. Patent No. 5,790,645 to Fawcett et al. (hereinafter Fawcett). 

GROUPING OF CLAIMS 

For each ground of rejection which appellant contests herein that applies to more than 
one claim, such additional claims, to the extent separately identified and argued below, do not 
stand or fall together. 

THE ARGUMENT 

Issue - Whether claims 2, 4-14, 16-18, 20, 22-25, 27-30 are patentable under 35 U.S.C. 
103(a) over Jiawei Han ("Towards On-Line Analytical Mining in Large Databases", 
hereinafter the Han reference) in view of U.S. Patent No. 6,236,978 to Tuzhilin, (hereinafter 
Tuzhilin) further in view of U.S. Patent No. 5,790,645 to Fawcett et al. (hereinafter Fawcett). 

Claim 27 

Paragraph 10 on page 5 of the Final Action refers to FIG. 1 and page 3, paragraph 4 of 
Han for teaching the first two steps recited by independent claim 27. Specifically, FIG. 1, and 
page 3, paragraph 4 of Han are referenced. However, it is respectfully submitted that Han 
fails to teach or suggest the steps of "retrieving a plurality of call records from the data 



warehouse," and "generating a calling profile cube based on the call records; wherein the 
calling profile cube includes information on multiple customers." 

For example, Figure 1 of Han illustrates an integrated on-line analytical mining 
(OLAM) on-line analytical processing (OLAP) architecture that shows a generic data cube. 
However, FIG. 1 of Han fails to teach or suggest, "generating a calling profile cube based on 
the call records; wherein the calling profile cube includes information on multiple 
customers," as claimed. 

Furthermore, Section 2.2 entitled Data Cube Construction describes very generally 
how data cube technology is important to on-line analytical mining. However, besides these 
broad generalization, the contents of the specific data cubes employed, how the specific data 
cubes are generated, and how these data cubes are used in a specific application according to 
the claimed invention are not taught or suggested. 

"Moreover, iris Te'spectM "data cube illustrated in Han arid related 

description on page 3 only describes a generic data cube or cuboid. However, Han does not 
appear to fairly teach or suggest the step of "generating a calling profile cube based on the 
call records; wherein the calling profile cube includes information on multiple customers." as 
claimed. 

The Final Action admits that the following steps: 

generating a volume-based calling pattern cube for each individual customer based on 

the multi-customer calling profile cube; 
comparing the volume-based calling pattern cube for each customer to a 

predetermined fraudulent volume-based calling pattern; and 
when the volume-based calling pattern cube is in a first predetermined relationship 

with predetermined fraudulent volume-based calling pattern, performing a first 

action 



are not taught by Han. However, the Final Action cites the Tuzhilin reference for teaching 
those steps (see page 6 of the Final Action) that are not taught by the Han reference. In 
particular, FIGS. 1-3 and col. 3, lines 40-41 of Tuzhilin are cited as teaching the above-noted 
steps. 

However, it is respectfully submitted that Tuzhilin fails to fairly teach the steps of 
"generating a volume-based calling pattern for each individual customer based on the multi- 
customer calling profile," and "comparing the volume-based calling pattern cube for each 
customer to a predetermined fraudulent volume-based calling pattern," as claimed. 

As argued below, appellant believes that the combination of Han, Tuzhilin, and 
Fawcett to be improper. However, even if Han and Tuzhilin and Fawcett were to be properly 
combined, which is not conceded, it is respectfully submitted that one skilled in the art would 
not arrive at the invention -as- claimed by-combining -the— Han y -Tuzhilin, --and— Fawcett 
references. 

Although FIGS. 1-3 of Tuzhilin are referenced by the Final Action as teaching the 
above-noted limitations, a review of these figures leads one to conclude that these FIGS. 1-3 
do not appear to teach or suggest the limitations of the claimed invention. 

For example, Figure 1 of Tuzhilin illustrates a process for generating a user profile. 
The general flowchart has the following steps: 1) retrieve user's past purchasing history, 2) 
build user profile based on (1) and 3) complete process when profile complete. (See Col. 3, 
lines 36 to 40). Figure 2 is a flowchart describing the generation of static and dynamic user 
profiles and provides more details of how a static profile and a dynamic profile are built for 
each user. FIG. 3 illustrates specific steps, such as, the step of compressing dynamic rules 
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(step 35) 3 generating aggregate rules (40), validating the aggregate rules by human expert (45) 
and validating individual rules (60). 

However, FIGS. 1-3 of Tuzhilin do not appear to teach or suggest the step of 
"generating a volume-based calling pattern for each individual customer based on the multi- 
customer calling profile." 

Furthermore, in contrast to the claimed invention, the user profiles of Tuzhilin appear 
to be generated directly from past purchase histories (e.g., a customer file (CUST) and a 
transaction file (TRANS)). Col. 5, lines 1-15 generally describes the process of generating 
user-specific rules (dynamic profile construction) according to Tuzhilin, which uses fields 
from a transaction file to generate rules and assigning the rules to a customer. The Tuzhilin 
method is very different from the claimed method, which uses specific intermediate steps to 
generate a customer calling profile as claimed. 

"Moreover, Tuzhilin appears "to teach the use of "individual profiles, wHetHerstatic or 
dynamic, instead of a multi-customer calling profile as claimed. 

Furthermore, col. 3, lines 31-37 of the Tuzhilin reference is directed at building a 
"user's past purchasing history," and not the specific limitations of the claimed invention. 

Stated differently, the Tuzhilin approach to generating customer profile is very 
different from the claimed method. Furthermore, the figures and related description of the 
Tuzhilin reference do not fairly teach or suggest the step of " generating a volume-based 
calling pattern for each individual customer based on the multi-customer calling profile ," as 
claimed. Perhaps, the Action can cite a particular portion or element that specifically teaches 
the specific processing as claimed. 
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The Action further refers to FIGS. 1-3, col. 11, line 65, and col. 3, line 40-41 of 
Tuzhilin as teaching the step of "comparing the volume-based calling pattern for each 
customer to a predetermined fraudulent volume-based calling pattern." 

The above-noted cited portions appear to be directed to using the purchasing history 
of a user (provided by Purchasing History Storage Unit 120), a user's profile (provided by 
User Profile Generation 1 1 0) and external information about the user (provided by State of 
the User Module 160) to estimate a user's future purchasing needs (col. 11, lines 42-52), 
which is generally un-related to the specific limitations of the claimed invention. 

Furthermore, the User Estimated Purchasing Needs module 140 and its operation is 
not the same nor does it teach or suggest the step of " comparing the volume-based calling 
pattern for each customer to a predetermined fraudulent volume-based calling pattern ," as 
claimed. 

Claim 28 

The references, whether alone or in combination, fail to teach or suggest the 
generation or use of a probability-based calling pattern cube in connection with a method of 
detecting telecommunication fraud as claimed. Specifically, claim 28 recites, " generating a 
probability-based calling pattern cube based on the volume-based calling pattern cube for 
each individual customer ," and the step of " comparing the probability-based calling pattern 
cube for each customer to a predetermined fraudulent probability-based calling pattern ." The 
generation and use of probability-based calling pattern cubes and the attendant advantages are 
set forth in specification on page 16, line 24 to page 22, line 10. 

The 9/10/2002 Final Action (page 11, first full paragraph) refers to FIGS. 3-5 and the 
Abstract of Fawcett et al. for teaching the above-noted claim limitations. The Abstract 
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describes a technique for automatically designing a fraud detection system using a series of 
machine learning methods. Specifically, rule-learning is used to uncover indicators of 
fraudulent behavior from a large user database. FIG. 3 illustrates the generic use of the fraud 
detection system designed in accordance with the methodology of FIG. 2. FIG. 4 illustrates a 
flow diagram for the selection of rules used in the profiler templates to instantiate the 
profilers. FIG. 5 shows the generated fraud detection system in place operating on exemplary 
customer account-day data. 

However, after a review of the cited references, there does not appear to be any 
teaching of the above-noted claims limitations directed to probability-based calling pattern 
cube was found. 

In this regard, it is respectfully requested that the Action specifically point out those 
portions of the cited references that teach or suggest the generation and use of probability- 
b^e^^llihg^atterh cubes ~as~claimed" ~~ ... 

Furthermore, the references, whether alone or in combination, fail to teach or suggest 
the step of when the probability-based calling pattern cube is in a first predetermined 
relationship with predetermined fraudulent probability-based calling pattern , performing a 
first action," as claimed. 

On page 1 1 , the Action appears to cite Fawcett as teaching the generation and use of 
probability-based calling pattern cube as claimed. However, the Fawcett system does not 
fairly teach or suggest probability-based calling pattern cube. 

The Abstract, for example, describes the Fawcett technique as a fraud detection 
system that uses machine learning methods. Rule learning is used to uncover indicators of 
fraudulent behavior. The indicators are used to create profilers that are then used to generate 
high confidence intervention activities. FIGS. 3 to 5 of Fawcett are directed to a generic use 



of the fraud detection system, a flow diagram for the selection of rules used in the profiler 
templates to instantiate the profilers, and a generated fraud detection system operating on 
exemplary customer account-day data, respectively. 

The above cited portions and Col. 7, lines 30-32 of Fawcett fail to teach or suggest the 
generation or use of a probability-based calling pattern cube as claimed. 

Fawcett Reference 

Fawcett is relied upon for teaching detecting telecommunication fraud. Specifically, 
col. 2, lines 46-52, col. 7, lines 30-32, Abstract and FIGS. 3-5 are relied upon for teaching 
various claimed aspects of claims 3, 28, 30. However, it is respectfully submitted that the 
Fawcett reference, whether alone or in combination with the Tuzhilin reference and the Han 
reference, fails to teach or suggest the telecommunication fraud detection method and system, 
as claimed. 

Furthermore, the Fawcett reference is not believed to be relevant to the claimed 
invention since this patent may be relied upon only to teach a technique for automatically 
designing a fraud detection system by using a series of machine learning methods and is not 
relevant to specific telecommunication fraud method and data processing system in 
accordance with the claims on appeal. Specifically, Fawcett, whether alone or in 
combination, fails to fairly teach or suggest the specific steps and structures recited by the 
claimed invention. 

Claims 2-13, 15-20, 22-25, 29 and 30 respectively dependent on claims 27, 28 and 14, 
are considered allowable by virtue of their dependencies. These dependent claims are further 
considered allowable on their own merits as they recite other features of the invention neither 
taught nor suggested by the applied references. 
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Claim 20 

Dependent claim 20 recites, "utilizing an OLAP server to create a calling profile cube, 
updated calling profile cubes, derive calling pattern cubes from the calling profile cube, 
analyzing calling pattern cubes, and comparing calling pattern cubes." Moreover, dependent 
claim 20 further recites, "wherein OLAP programming supported by the OLAP server 
provides a scalable computation engine for generating and processing the calling pattern 
cubes." It is respectfully asserted that Han, whether alone or in combination with Tuzhilin 
and Fawcett, fails to teach or suggest these limitations as claimed. 

Claim 30 

Regarding claim 30, Han page 7, section 3.4 is cited as teaching the limitations recited 
thereby. Han page 7, section 3.4 is directed to Mining Periodicity Patterns and does not teach 
-or-suggest-the-generation-or-use-of a~probability=based-calling^pattern-cube-asxlaimed.- 

Similarly, Tuzhilin, FIG. 3, col. 2, lines 41-67 is directed to "dynamic profiles to 
provide better recommendation to users as to which products and services each individual 
user can use" and does not teach or suggest the generation or use of a probability-based 
calling pattern cube as claimed. 

Specifically, it is noted that FIG. 3 of Tuzhilin, illustrates 1) how individual rules are 
compressed, 2) used to generate aggregate rules, which are validated, and 3) how individual 
rules are validated. However, FIG. 3 of Tuzhilin does not fairly teach or suggest or is even 
remotely related to the generation or use of a probability-based calling pattern cube as 
claimed. 

The Final Action and Advisory Action do not appear to address these limitations. 
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It is respectfully submitted that the resulting combination of references would not 
motivate one of ordinary skill to utilize OLAP programming supported by the OLAP server to 
provide a scalable computation engine for generating and processing calling pattern cubes, 
such as is presently claimed. 

Han, Tuzhilin, and Fawcett et al. do not appear to disclose these features of the 
claimed invention. Moreover, it is unclear from the lengthy Final Rejection specifically how 
the references teach or suggest these claimed features. It would be very helpful to the 
appellant and consistent with proper examination practice if the Action would indicate 
specific elements or portions within the applied references that teach specific claimed features 
instead of simply parroting the language in the present claims on Appeal as alleged 
disclosures within the applied references. 

This comment is not intended to be criticism but merely a plea for greater specificity 
solhat the applicant/appellant may clearly und^taffl"wHat~disclosures are "being relied upon 
in the appropriate references to reject these dependent claims. 

THE PROPOSED COMBINATION OF HAN, TUZHILIN & FAWCETT IS BASED ON 
IMPERMISSIBLE USE OF THE CLAIMED INVENTION AS A TEMPLATE TO PIECE 
TOGETHER THE TEACHINGS OF THE CITED REFERENCES. 

Regarding the claims 14, 27 & 28, the Actions have proposed combining the Han 
reference, the Tuzhilin reference and the Fawcett reference to render obvious the claimed 
invention. Specifically regarding the method claims 27 & 28, Han is cited for teaching the 
first three claimed steps, Tuzhilin is cited for teaching the next three claimed steps, and 
Fawcett is cited for teaching the design of fraud detection systems. 
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First, it is respectfully submitted that neither the Han reference, the Tuzhilin reference 
nor the Fawcett reference explicitly or implicitly teaches or suggests any motivation to 
combine the respective teachings of the different systems to arrive at the claimed invention. 

The first paragraph on page 8 of the Final Action dated 9/10/2002 states, "It would 
have been obvious to a person having ordinary skill in the art at the time the invention was 
made to have modified Han by the teaching of Tuzhilin to include . . . with the motivation to 
more efficiently serve the user as taught by Tuzhilin and in order to detect any abnormal 
activity." The Final Action further cites column 1, lines 22 to 26 of Tuzhilin for the 
motivation to combine that states, "If the user profiles are generated in a highly relevant and 
comprehensible manner with respect to a specific user, the applications would be able to 
understand that user's needs better and more efficiently serve that user." 

Similarly, the fourth paragraph on page 8 of the Final Action dated 9/10/2002 states, 

"It would have been obvious to a person having - ordinary skilFin the art at the time the 

invention was made to have modified Han by the teaching of Tuzhilin to include: detecting 

telecommunication fraud, with the motivation to more effectively generate a fraud detection 

system in a relatively brief time frame so that the fraud detection system is well adapted to 

current fraudulent schemes as taught by Fawcett." The Final Action cites column 2, lines 46 

to 53 of Fawcett that states 

One feature of the arrangement of the present invention is its usefulness in generating 
a fraud detection system in a relatively brief time frame (for example, overnight) so 
that the fraud detection system is well adapted to current fraudulent schemes. In 
addition, the fraud detection system provides measures of fraudulent activity that are 
not particularly intuitive, so the measures have been overlooked in conventional fraud 
detection systems. 
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Based on the above portions, the Action suggests that the Han architecture be 
modified with the user profiling of Tuzhilin and that the resulting combination be further 
combined in the fraud detection system of Fawcett. However, the Federal Circuit has stated, 
"The mere fact that the prior art may be modified in the manner suggested by the Examiner 
does not make the modification obvious unless the prior art suggested the desirability of the 
modification ." In re Fritch , 972 F.2d 1260, 23 USPQ 2d 1780, 1783-84 (Fed. Cir. 1992) 
[emphasis added]. 

The cited portions do not appear to suggest the desirability of modifying the Han 
reference with the teachings of Tuzhilin and Fawcett. Instead, the above portions appear only 
to discuss an advantage of the respective invention (e.g., an advantage of the Fawcett 
invention and an advantage of the Tuzhilin). 

The Federal Circuit has further held In re Fritcfcu 972 F.2d 1260, 23 USPQ 2d 1780, 

1783 (Fed. Cir. 1992): 

In proceedings before the Patent and Trademark Office, the Examiner bears the 
burden of establishing a prima facie case of obviousness based upon the prior art . ... 
"[The Examiner] can satisfy this burden only by showing some objective teaching in 
the prior art ... would lead that individual to combine the relevant teachings of the 
references. In re Fine , 837 F.2d 1071, 1074, 5 USPQ 2d 1596, 1598 (Fed. Cir. 1988). 
[emphasis added.] 

It is respectfully submitted that the references do not suggest the desirability of the 
suggested modification. Consequently, it appears that the current patent application has been 
improperly used as a basis for the motivation to combine or modify the components selected 
from Han, Tuzhilin, and Fawcett to arrive at the claimed invention. 

However, the Federal Circuit has ruled, " It is impermissible to use the claimed 
invention as an instruction manual or "template" to piece together the teachings of the prior 
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art so that the claimed invention is rendered obvious . This court has previously stated, "[o]ne 

cannot use hindsight reconstruction to pick and choose among isolated disclosures in the prior 

art to deprecate the claimed invention." (quoting In re Fine, 837 F.2d 1071, 1075, 5 USPQ 2d 

1596, 1600 (Fed. Cir. 1988)), In re Fritch , 23 USPQ 2d 1780, 1784 (Fed. Cir. 1992). 

[emphasis added.] 

The Federal Circuit further held: 

The genius of invention is often a combination of known elements which in 
hindsight seems preordained. To prevent hindsight invalidation of patent claims, 
the law requires some "teaching, suggestion or reason" to combine cited 
references. Gambro Lundia AB v. Baxter Healthcare Corp. , 110 F. 3d 1573, 1579, 
42 USPQ 2d 1378, 1383 (Fed. Cir. 1997). When the art in question is relatively 
simple, as is the case here, the opportunity to judge by hindsight is particularly 
tempting. Consequently, the tests of whether to combine references need to be 
applied rigorously. McGinlev v. Franklin Sports Inc. , 60 USPQ 2d 1001, 1008 
(Fed. Cir. 2001). 

Hindsight reconstruction may not be used to pick some components from Han and 
some other components from Tuzhilin and some other components from Fawcett to arrive at 
the invention as claimed. Accordingly, it is respectfully requested that the rejection of claims 
2-14, 15-18, 20, 22-25 and 27-30 under 35 U.S.C. 103(a) be withdrawn. 
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CONCLUSION 

For the reasons advance above, Appellant respectfully contends that each claim is 
patentable. Therefore, reversal of all rejections is courteously solicited. 

Respectfully submitted, 



Eric Ho 

Registration No. 39,71 1 
Attorney for Applicant 
20601 Bergamo Way 
Northridge, CA 91326 
818 998 7220 

Date: August 9, 2003 

I hereby certify that this correspondence is being deposited with the United States Postal 
Serviee-as-first-class-mail-in-an-envelope-addressed-to: -Commissioner For Eatents,_P.O.-Box 
1450, Alexandria, VA 22313-1450 on the date below. 





August 9. 2003 



Eric Ho 



(Date) 
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APPENDIX 



2. A method as in claim 27 wherein said data warehouse has a call table and a profile 
table, wherein the step of generating a calling profile cube based on the records further 
comprises the steps of: 

retrieving records from the call table and based thereon generating a snapshot cube 
representing the records from the call table, said snapshot cube having 
predetermined dimensions; 

retrieving records from the profile table and based thereon generating a profile cube 
representing the records from the profile table, said profile cube having 
predetermined dimensions that are the same as the dimensions of the snapshot 
cube; 

merging the snapshot cube and the profile cube to generate an updated profile cube; 
and 

deriving the volume-based calling pattern cubes based on the updated profile cube. 

3. A method as in claim 27 wherein the step of when the volume-based calling pattern 
cube is in a first predetermined relationship with predetermined fraudulent volume-based 
calling pattern, performing a first action includes one of: 

flagging a particular caller with the volume-based calling pattern being analyzed as 
suspicious; 

automatically generating an alert that specifies callers with suspicious volume-based 
calling pattern; 

performing further investigation on callers with suspicious volume-based calling 
pattern; 

cancellation of telephone services for callers with suspicious volume-based calling 

pattern; and 
performing other appropriate remedial actions. 



4. A method as in claim 27 further comprising: 

analyzing the calling pattern cube by utilizing at least one OLAP operation. 

5. A method as in claim 4 wherein said OLAP operations is one of a roll-up operation, a 
drill-down operation, a dice operation, a slice operation, and an ad-hoc query. 

6. A method as in claim 27 wherein the predetermined fraudulent volume-based calling 
pattern in one of a personalized calling pattern and a group-based pattern. 

7. A method as in claim 2 further comprising: 

storing the updated profile cube into the profile table in the data warehouse; and 
performing data staging between the profile table and the updated profile cube at 
predetermined time intervals. 

8. A method as in claim 2 wherein said profile cube, snapshot cube, and updated profile 
cube each includes at least two dimensions and at least two levels. 



9. A method as in claim 8 further comprising: 

analyzing the calling pattern cube by utilizing at least one OLAP operation along more 
than one level. 

10. A method as in claim 8 further comprising: 

analyzing the calling pattern cube by utilizing at least one OLAP operation along more 
than one dimension. 
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A method as in claim 2 wherein the profile cube, snapshot cube, and the updated 
profile cube each are multi-level and multi-dimensional cubes. 



12. A method as in claim 2 wherein the profile table and the call table each has a plurality 
of attributes, and the profile cube and snapshot cube each has a plurality of dimensions, said 
attributes corresponding in a one-to-one fashion to the dimensions. 

13. A method as in claim 2 wherein the profile cube includes at least one cell having 
probability based values. 

14. A data processing system comprising: 

a data warehouse for storing data in a relational format, said data warehouse including 

a profile table and a call table; 
an OLAP server, coupled to the data warehouse, for providing predetermined OLAP 

operations; and 

a profile engine, coupled to the data warehouse for computing, maintaining and 
utilizing caller pattern cubes that represent caller profiles; wherein the caller 
pattern cubes can be utilized to detect telecommunication fraud. 

15. A data processing system as in claim 14 further comprising: 

a fraud detection module for detecting telecommunication fraud by comparing known 
fraudulent profiles to caller pattern cubes; 

the profile engine further generating a profile cube from information selected from the 
profile table, generating a snapshot cube, updating the profile cube by merging 
the profile cube and the snapshot cube to generate an updated profile cube, and 
deriving a calling pattern cube based on the updated profile cube; wherein the 
profile engine is a scalable computation engine that is implemented by OLAP 
programming supported by the OLAP server. 

16. A data processing system as in claim 14 further comprising: 
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an analysis tool for use by a data analyst to perform one of comparing the calling 
pattern cube to known fraudulent calling pattern cube and extracting 
information from the calling pattern cube based on selected dimensions, levels, 
and ad-hoc queries provided by the data analyst. 



17. A data processing system as in claim 14 further comprising: 

a visualization tool for use by a data analyst to display the calling pattern cube in 
different formats, levels, and dimensions. 



18. A data processing system as in claim 14 further comprising: 

a data staging tool for transferring data between the profile cube stored in the OLAP 
server and profile table in the data warehouse at predetermined time intervals. 



20. A method as in claim 27 further comprising: 

utilizing an OLAP server to create a calling profile cube, updated calling profile 
cubes, derive calling pattern cubes from the calling profile cube, analyzing 
calling pattern cubes, and comparing calling pattern cubes; 

wherein OLAP programming supported by the OLAP server provides a scalable 

computation engine for generating and processing the calling pattern cubes. 

22. The method of claim 28 wherein the calling profile cube is a multi-dimensional and a 
multi-level cube and wherein the volume-based calling pattern cubes are multi-dimensional 
and a multi-level cubes. 

23. The method of claim 28 further comprising: 
performing data staging at predetermined time intervals; and 

updating the calling profile cube by generating a snapshot cube from a call table; and 
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merging the snapshot cube with the calling profile cube to generate an updated calling 
profile cube. 

24. The method of claim 28 wherein the calling profile cube has a cell that includes a 
probability distribution value based on one of the probability distribution on calls to each 
callee and the probability distribution on all calls. 

25. The method of claim 22 wherein the dimensions include a day-of-week hierarchy, a 
time hierarchy, and a duration hierarchy. 

27. A method for detecting telecommunication fraud performed in a data processing 
system having a data warehouse and an OLAP server, the method comprising: 

retrieving a plurality of call records from the data warehouse; 

generating a calling profile cube based on the call records; wherein the calling profile 

cube includes information on multiple customers; 
generating a volume-based calling pattern cube for each individual customer based on 

the multi-customer calling profile cube; 
comparing the volume-based calling pattern cube for each customer to a 

predetermined fraudulent volume-based calling pattern; and 
when the volume-based calling pattern cube is in a first predetermined relationship 

with predetermined fraudulent volume-based calling pattern, performing a first 

action. 

28. A method for detecting telecommunication fraud performed in a data processing 
system having a data warehouse and an OLAP server, the method comprising: 

retrieving a plurality of call records from the data warehouse; 

generating a calling profile cube based on the call records; wherein the calling profile 
cube includes information on multiple customers; 
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generating a volume-based calling pattern cube for each individual customer based on 

the multi-customer calling profile cube; 
generating a probability-based calling pattern cube based on the volume-based calling 

pattern cube for each individual customer; 
comparing the probability-based calling pattern cube for each customer to a 

predetermined fraudulent probability-based calling pattern; 
when the probability-based calling pattern cube is in a first predetermined relationship 

with predetermined fraudulent probability-based calling pattern, performing a 

first action. 

29. A method as in claim 28 wherein the step of when the probability-based calling 
pattern cube is in a first predetermined relationship with predetermined fraudulent 
probability-based calling pattern, performing a first action includes one of: 

flagging a particular caller with the probability-based calling pattern being analyzed as 
suspicious; 

automatically generating an alert that specifies callers with suspicious probability- 
based calling pattern; 

performing further investigation on callers with suspicious probability-based calling 
pattern; 

cancellation of telephone services for callers with suspicious probability-based calling 

pattern; and 
performing other appropriate remedial actions. 

30. The method of claim 29 wherein the probability-based calling patterns enables one of 
the analysis and comparison of a first probability-based calling patterns that covers a first 
time period with a second probability-based calling patterns that covers a second time period. 



21 



